Update:

For question 1, I found that the publicize image feature still work, 
but need to do this on command line by using openstack image 
set. Also found "403 Forbidden" error [1] is threw by Horizon when
trying to modify visibility and image properties on private 
image/snapshot. Does someone know how to disable this limitation
in Horizon?

For question 2 is totally solved. The workaround in Sysprep is working
actually.

[1] The error message shown in Horizon is:
"Forbidden. Insufficient permissions of the requested operation"

Eddie Yen <missile0407@gmail.com> 於 2021年3月26日 週五 上午7:50寫道:
Hi everyone, I want to ask about the image operating permission & 
Windows images issue we met since we can't find any answers on the 
internet.

1. Now we're still using Rocky with Ceph as storage. Sometimes we 
need to re-pack the image on the Openstack. We used to save as 
snapshot (re-pack by Nova ephemeral VM) or upload to image (re-pack 
by volume), then set snapshot/image's visibility to the public. But since
Rocky, we can't do this anymore because when we try to set public,
Horizon always shows "not enough permission" error. 
The workaround we're using for now is creating a nova snapshot after
re-pack, download the snapshot, then upload the snapshot again as 
public. But it's utterly wasting time if the images are huge. So we want to
know how to unleash this limitation can let us just change snapshot to
public at least.

2. Openstack uses virtio as a network device by default, so we always 
install a virtio driver when packing Windows images. As the network
performance issue in GSO/TSO enablement, we also need to disable
them in device properties. But since Windows 10 2004 build (my thought)
device properties always reset these settings after Sysprep. We found 
there's a workaround [1] to solve this issue, but may not work sometimes.
Is there a better way to solve this issue?

Many thanks,
Eddie.

[1] PersistAllDeviceInstalls | Microsoft Docs